]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
firmware: imx: scu: Fix corruption of header
authorFranck LENORMAND <franck.lenormand@nxp.com>
Wed, 25 Mar 2020 22:00:05 +0000 (00:00 +0200)
committerKhalid Elmously <khalid.elmously@canonical.com>
Sat, 8 Aug 2020 05:53:12 +0000 (01:53 -0400)
commitb520201a313884231a7bd09010ac1e35b6518f91
tree57b85e3581990a6ee2dcaa7de093987cc246c357
parent582210509634efe887d7bd6dbcea4871552d991e
firmware: imx: scu: Fix corruption of header

BugLink: https://bugs.launchpad.net/bugs/1884089
[ Upstream commit f5f27b79eab80de0287c243a22169e4876b08d5e ]

The header of the message to send can be changed if the
response is longer than the request:
 - 1st word, the header is sent
 - the remaining words of the message are sent
 - the response is received asynchronously during the
   execution of the loop, changing the size field in
   the header
 - the for loop test the termination condition using
   the corrupted header

It is the case for the API build_info which has just a
header as request but 3 words in response.

This issue is fixed storing the header locally instead of
using a pointer on it.

Fixes: edbee095fafb (firmware: imx: add SCU firmware driver support)
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/firmware/imx/imx-scu.c